AI Act Deployer Obligations (Article 26): What Irish Employers Using High-Risk AI Must Do

If your organisation uses a high-risk AI system rather than building one, the part of the EU AI Act that matters most to you is Article 26. It sets out what the Act calls "deployer" obligations: using the system as instructed, giving oversight to competent people, watching how it performs, keeping logs, and telling workers and affected people. This guide walks through those duties for employers in Ireland, including Dublin-based HR and finance teams, and flags where the dates and details are still moving.

It is a companion to our overview of EU AI Act key dates for employers in Ireland, so we concentrate here on what Article 26 actually asks of a deployer. Everything below is based on the Commission's AI Act Service Desk pages, which paraphrase the EUR-Lex text, and on Irish government pages. This is general information, not legal advice.

Are you a "deployer"?

According to the gov.ie page "The EU AI Act and my organisation" (published and last updated 27 May 2026), deployers are organisations that use AI in their operations, with hiring given as one example. That covers private and public sector use. So an Irish employer that buys a CV-screening tool, a performance-monitoring platform or a credit-scoring product from a vendor is typically the deployer, and the vendor is the provider.

Article 26 applies to deployers of high-risk systems. Under Annex III, the high-risk list includes systems used in employment and workers' management: placing targeted job adverts, screening and analysing applications, evaluating candidates, making decisions on working conditions, promotion or dismissal, allocating tasks based on behaviour or personal traits, and monitoring and evaluating the performance or conduct of workers. Other Annex III areas include credit scoring and education. The list is on the Commission's AI Act Service Desk page for Annex III, which shows no date of its own.

Article 6 adds nuance. It says an Annex III system can fall outside the high-risk category if it poses no significant risk of harm to health, safety or fundamental rights, for example where it only performs a narrow procedural task, but profiling of natural persons always counts as high-risk. A provider that concludes its system is not high-risk has to document that assessment. As a deployer, ask your vendor which position it has taken, and why.

When do the obligations apply?

This is the point to check carefully. The Service Desk's consolidated text of the AI Act, shown "as at 27 July 2026", marks Article 113 as amended by the Digital Omnibus on AI and gives 2 December 2027 for high-risk systems under Article 6(2) and Annex III, and 2 August 2028 for high-risk systems embedded in products under Annex I. The Service Desk timeline page says the same, flags both dates as amended, and shows no page date.

The picture across official pages is not perfectly uniform, though. The Commission's Service Desk FAQ describes the Digital Omnibus as a Commission proposal and does not say whether it has been adopted, and the Service Desk's page for Article 25 says that provision has been amended by the Omnibus but its displayed text has not yet been updated. The European Parliament's legislative observatory summary, dated 26 March 2026, records Parliament's proposed dates of 2 December 2027 and 2 August 2028 and notes the file was sent back to committee for negotiations. Our suggestion: treat 2 December 2027 as the date shown on the Commission's current consolidated text, and check the Official Journal and the Commission's pages before you rely on it for planning.

The Article 26 duties in plain English

The Service Desk page for Article 26 sets out twelve paragraphs. The ones that matter to a typical private employer are these.

• Use the system as instructed. Deployers must take appropriate technical and organisational measures to use the system in line with the provider's instructions for use.
• Assign human oversight to the right people. Oversight must go to people with the necessary competence, training and authority, and with the support they need.
• Check your input data. Where the deployer controls the input data, it must ensure the data is relevant and sufficiently representative for the system's intended purpose.
• Monitor and escalate. Deployers must monitor operation against the instructions and inform the provider where relevant. If they have reason to believe the system may present a risk, they must promptly notify the provider or distributor and the market surveillance authority and suspend use. For serious incidents they must notify the provider immediately, then the importer or distributor and the authorities.
• Keep logs. Where the logs are under the deployer's control, they must be kept for at least six months, unless other law, such as data protection law, provides otherwise.
• Inform workers. Before putting a high-risk system into service or using it at work, an employer must inform workers' representatives and the affected workers, following applicable EU and national rules.
• Use the provider's information for your data protection assessment. Where applicable, deployers must use the information supplied by the provider to carry out a data protection impact assessment under GDPR.
• Tell affected people. Deployers of Annex III systems that make or assist decisions about natural persons must inform those people that the system is being used.
• Cooperate with authorities. Deployers must cooperate with competent authorities on any action they take about the system.

The article also contains rules specific to public authorities, to financial institutions and to law-enforcement use of biometric identification. Those are outside the scope of this guide.

What "human oversight" means in practice

Article 26 relies on the oversight design in Article 14. The Service Desk page for Article 14 describes oversight that lets people understand the system's abilities and limits and spot anomalies, stay aware of automation bias (the tendency to over-rely on output, especially when a system recommends decisions), interpret output correctly, choose not to use the system or override and reverse its output, and intervene or stop the system. The page shows no date of its own beyond the consolidated-text date of 27 July 2026.

For an HR team that means a recruiter reviewing a ranked shortlist should be able to understand why candidates are ranked as they are, should be trained to challenge the ranking, and should be free to ignore it. A practical approach: record who the named oversight owners are, what training they received and how they can escalate, so you can show the oversight was real and not nominal.

When a deployer can become a provider

Article 25, as paraphrased on the Service Desk page, says a deployer takes on the provider's obligations if it puts its own name or trademark on a high-risk system, substantially modifies a high-risk system so that it stays high-risk, or changes the intended purpose of a system that was not high-risk so that it becomes high-risk. Because the Service Desk notes that Article 25 has been amended by the Omnibus but not yet updated on the page, check the current wording. In practice, the caution is clear: repurposing a general-purpose tool for screening candidates is the kind of change worth taking advice on first.

Who enforces this in Ireland?

The gov.ie page says Ireland uses a distributed model in which existing regulators act as competent authorities and that an AI Office of Ireland is planned as the central coordination point. The AI Office of Ireland's list of national competent authorities includes the Workplace Relations Commission, described as supervising the deployment and usage of AI systems in the Irish labour market, and the Data Protection Commission and the Central Bank of Ireland, each described as a market surveillance authority for certain prohibited practices and high-risk uses, with only short descriptions and no detail of powers. The law is national and EU-wide; nothing in these pages creates Dublin-specific rules.

A practical checklist for deployers

These are our suggestions, not legal requirements.

• Keep an inventory of AI tools used in HR, finance and operations, including features switched on inside existing software.
• For each tool, ask the vendor for its instructions for use, its view on whether it is high-risk, and what logs you can access.
• Name the oversight owners and make sure they are trained. Our guide to AI literacy under Article 4 covers the separate training duty, and our article on AI in recruitment and HR under the EU AI Act goes deeper on hiring tools.
• Agree who talks to the vendor, the authority and affected staff if something goes wrong.
• Draft worker and candidate notices early, and involve employee representatives where relevant.
• Decide log retention with data protection in mind, since Article 26 itself defers to data protection law.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Does Article 26 apply to every AI tool we use?

No. The page for Article 26 concerns high-risk systems. gov.ie says most AI systems are considered low risk. Your first job is to classify what you use.

Do we have to keep logs for six months?

The Article 26 page says logs the system generates must be kept for at least six months where they are under the deployer's control, unless other law, such as data protection law, provides otherwise. If the logs sit with the vendor, ask what access you have.

Do we have to tell employees before using a high-risk system?

According to the Article 26 page, an employer must inform workers' representatives and affected workers before putting a high-risk system into service or using it at work, in line with applicable rules. The page does not set out how to do so, so check national employment rules.

Is there a separate impact assessment duty?

Article 27 requires a fundamental rights impact assessment from some deployers, which is a narrower group than all deployers. Separately, Article 26 points to a GDPR data protection impact assessment where applicable.

Because dates and wording are still being updated, review the Commission's AI Act pages and the Official Journal before finalising your compliance plan.